What’s Vulnerable › Vulnerabilities

CVE-2026-44423: ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-13 · updated 2026-06-17
• Weakness: CWE-639

Description

ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by the caller's tenant. An authenticated user can read session records (SSH username, device UID, remote IP, terminal type, authenticated flag, timestamps) belonging to any other namespace. This vulnerability is fixed in 0.24.2.

Affected products

• shellhub-io shellhub: before 0.24.2 — fixed in 0.24.2

How to fix

Upgrade to a fixed version: shellhub-io shellhub 0.24.2. Check the vendor advisory for mitigations.

References

• https://github.com/shellhub-io/shellhub/security/advisories/GHSA-9w9c-9w8m-w89q
• https://github.com/shellhub-io/shellhub/security/advisories/GHSA-9w9c-9w8m-w89q

Get alerted when CVE-2026-44423 or the next vulnerability affects your stack